Privilege escalation is the act of gaining a higher level of access than an account was meant to have. An attacker who starts with an ordinary user account uses it to reach administrator rights, sensitive data or more powerful systems. It is a common step between initial access and serious impact.

What types of privilege escalation are there?

• Vertical escalation: moving from a lower level of privilege to a higher one, for example from user to administrator.
• Horizontal escalation: taking over another account at the same level to reach different data or systems.

How does privilege escalation happen?

• Exploiting software vulnerabilities that give higher rights.
• Abusing misconfigurations, such as weak permissions or excessive group membership.
• Stealing credentials of more privileged accounts.
• Manipulating tokens and sessions.
• Abusing roles and policies in cloud platforms.
• Persuading a help desk or a colleague to grant access.

Why does privilege escalation matter?

Initial access is usually limited. Escalation turns a small foothold into control. Once an attacker holds administrative rights, they can change security settings, create new accounts, reach sensitive data and move across the environment.

What does privilege escalation look like in practice?

An attacker with a standard account finds that it is a member of a group that can reset passwords for an administrative group. They reset an administrator’s password, sign in with it and now control the domain. No software flaw was involved, only a permission nobody had reviewed.

Which misconfigurations make escalation easy?

• Groups that can reset passwords or change group membership.
• Service accounts placed in privileged groups.
• Weak permissions on services, files or scheduled tasks.
• Cloud policies that let an identity assume or create more powerful roles.
• Accounts that hold rights nobody remembers granting.

How is it different from privilege abuse?

Escalation is gaining rights that an identity should not have. Abuse is misusing rights that it legitimately holds, as an insider might. The first changes what an account can do, and the second changes what it does with what it already can do.

How does it relate to lateral movement?

They often alternate. Moving sideways gives the attacker new places to find credentials, and escalation gives them the rights to move further. Together they turn one account into control of an environment.

What is privilege escalation in the cloud?

The same idea applied to roles and policies. An identity with limited rights may be able to assume a more powerful role, modify its own permissions or create resources that carry more access. Overly broad policies make this much easier.

What are the warning signs?

• Accounts added to privileged groups or roles.
• Permissions changed outside normal change windows.
• An identity using rights it has never used before.
• New administrative accounts or roles.
• Sudden use of tools that read credentials from memory.

How do you prevent privilege escalation?

• Apply least privilege and remove excess permissions.
• Keep privileged groups small and review them often.
• Grant elevated access only when needed, and for a limited time.
• Patch systems promptly.
• Remove local administrator rights that are not needed.
• Review cloud roles and policies for unintended paths.

How do you detect it?

By watching for changes to privileges and for identities that act beyond their normal pattern. A new group membership, a role assumption or an unusual administrative action by an ordinary account is often the first visible sign.

Sharelock maps identities and privileges to show escalation paths before an attacker uses them, and monitors behaviour after login, so unusual use of new rights stands out.

‍